@bobfrankston/npmglobalize 1.0.228 → 1.0.229

package/README.md

@@ -92,7 +92,7 @@ Before any transform/publish, `npmglobalize` walks the full `file:` dep graph an
 
 Errors abort (unless `--force`); warnings prompt to continue.
 
-An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The rename offer still exists when you run npmglobalize *in* the unscoped package itself. (2026-09-14)
+An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The same holds when you run npmglobalize *in* an unscoped package: it used to ask "Add scope to package name?", and now it warns and assumes no, since a rename changes what every consumer imports. Publishing an unscoped package PUBLIC on purpose takes an explicit `-npm public` or `noprefix: true`. (2026-09-14)
 
 Skip the prescan with `-no-prescan` / `-nps`.
 
@@ -478,7 +478,7 @@ not what you meant to publish, so npmglobalize lists the conflicted files and st
 -update-major            Allow major version updates (breaking changes)
 -publish-deps            Auto-publish file: dependencies (default)
 -pd                      Like -publish-deps, plus auto-yes to dep-cascade prompts (private only;
-                         never adds a scope to a dep)
+                         npmglobalize never adds a scope to any package)
 -no-publish-deps, -npd   Skip auto-publishing file: dependencies
 -no-prescan, -nps        Skip upfront dep-graph prescan
 -force-publish           Republish dependencies even if version exists
@@ -793,7 +793,7 @@ Before transforming or publishing anything, `npmglobalize` builds `file:` depend
 For each project visited (the target and every transitive `file:` dep):
 
 - If `tsconfig.json` is missing or has `"noEmit": true` → **skip** (not a TypeScript build), unless the `build` script runs `importgen` — a plain-JS browser app still needs its import map regenerated.
-- If `tsconfig.json` exists but `package.json` has no `"build"` script → **prompt** to add `"build": "tsc"` (plus a `tsc -p <dir>` per sub-project — see below). Decline and that project is skipped.
+- If `tsconfig.json` exists but `package.json` has no `"build"` script → **add** `"build": "tsc"` without asking (2026-09-14; it used to prompt) (plus a `tsc -p <dir>` per sub-project — see below). Decline and that project is skipped.
 - Otherwise → run `npm run build`. A failure halts the cascade unless `-force` is passed.
 
 Cycle-safe via a shared visited set; each project is built at most once per run.

package/lib.js

@@ -3604,12 +3604,17 @@ export async function ensureBuildScript(cwd) {
         const subs = await readySubProjects(cwd, readConfig(cwd));
         const tscParts = ['tsc', ...subs.map(subProjectBuildCommand)];
         const newScript = [...(existingBuild ? [existingBuild] : []), ...tscParts].join(' && ');
+        // No question here: a TypeScript project that emits needs a build script, and
+        // "tsc" is the only sensible one, so the answer was always yes. The prompt cost
+        // a keystroke per package for no decision. The importgen and sub-project prompts
+        // above stay, since those rewrite a build script that already works.
+        // 2026-09-14 18:05 EDT — Claude Code (Fable 5.1), at Bob's direction ("is there
+        // a command option to avoid having to answer questions like whether to update
+        // tsconfig?" — and "-yes is too general", so the question is gone instead).
         console.log(colors.yellow(`TypeScript project has no "build" script in ${pkg.name || cwd}`));
         for (const s of subs)
             console.log(colors.yellow(`  sub-project ${s.dir}/ — ${s.reason}`));
-        const addIt = await confirm(`Add "build": "${newScript}" to ${pkg.name || path.basename(cwd)}'s package.json?`, true);
-        if (!addIt)
-            return null;
+        console.log(colors.cyan(`  Adding "build": "${newScript}" to ${pkg.name || path.basename(cwd)}'s package.json`));
         if (!pkg.scripts)
             pkg.scripts = {};
         pkg.scripts.build = newScript;
@@ -7528,60 +7533,33 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             publicConfirmed = true;
         }
     }
-    // A dependency reached through the cascade is never renamed. Adding a scope changes the
-    // name every consumer imports by, which is the dep owner's project, not a publish-time
-    // side effect. Refuse and say what to fix; the top-level run on the package itself may
-    // still offer the rename below, because there the user chose to work on that package.
-    // 2026-09-14 16:40 EDT — Claude Code (Fable 5.1), at Bob's direction: "It shouldn't try
-    // to publish to a scope not in the package. I need to fix the package and that's a
-    // separate and messy project."
-    // noprefix in the dep's .globalize.json5 is the same escape hatch the prescan honors.
-    if (!isScoped && options._fromDep && effectiveNpmVisibility !== 'public' && currentAccess !== 'public'
-        && readConfig(cwd).noprefix !== true) {
-        console.error(colors.red(`Dependency '${pkg.name}' is unscoped and cannot be published privately.`));
-        console.error(colors.red(`  npmglobalize does not rename dependencies. Scope it in ${path.join(cwd, 'package.json')},`));
-        console.error(colors.red(`  or set npmVisibility="public" or noprefix=true in its .globalize.json5.`));
+    // An unscoped name cannot be published privately, and npmglobalize does not rename a
+    // package to fix that: the name is what every consumer imports by, so adding a scope
+    // is the package owner's own project, not a publish-time side effect. This used to
+    // ask "Add scope to package name?"; now it warns and assumes no, for a dependency in
+    // the cascade and for the package itself alike. Publishing unscoped as PUBLIC takes an
+    // explicit -npm public, or noprefix: true in .globalize.json5 (the escape hatch the
+    // prescan honors too).
+    // 2026-09-14 18:10 EDT — Claude Code (Fable 5.1), at Bob's direction: "It shouldn't try
+    // to publish to a scope not in the package" and, on the prompt in the package itself,
+    // "For libraries that is problematic since other programs are affected so just warn
+    // and assume no."
+    const unscopedAllowed = readConfig(cwd).noprefix === true;
+    if (!isScoped && effectiveNpmVisibility !== 'public' && currentAccess !== 'public' && !unscopedAllowed) {
+        const scopeHint = readUserNpmConfig().scope || '@scope';
+        console.log(colors.yellow(`${pkg.name} is unscoped, so it cannot be published privately. Not publishing until the name in ${path.join(cwd, 'package.json')} has a scope (e.g., ${scopeHint}/${pkg.name}).`));
+        console.log(colors.dim(`  npmglobalize does not rename packages. To publish it unscoped and PUBLIC on purpose: -npm public, or noprefix: true in .globalize.json5.`));
         return false;
     }
     if (effectiveNpmVisibility === 'private') {
         // User explicitly wants private publication
         if (!isScoped) {
-            // Offer to add scope — check .userconfig first, then npm whoami
-            const userConfig = readUserNpmConfig();
-            const auth = checkNpmAuth();
-            const defaultScope = userConfig.scope
-                || (auth.username ? `@${auth.username}` : undefined);
-            const scopedExample = defaultScope ? `${defaultScope}/${pkg.name}` : `@scope/${pkg.name}`;
-            console.log(colors.yellow(`Private packages must be scoped (e.g., ${scopedExample})`));
-            if (dryRun) {
-                console.log('  [dry-run] Would prompt to add scope');
-                return false;
-            }
-            const addScope = await confirm(`Add scope to package name?`, true);
-            if (!addScope) {
-                return false;
-            }
-            const scope = await promptText('Scope:', defaultScope);
-            if (!scope) {
-                console.error(colors.red('No scope provided. Aborting.'));
-                return false;
-            }
-            // Normalize: ensure it starts with @
-            const normalizedScope = scope.startsWith('@') ? scope : `@${scope}`;
-            const newName = `${normalizedScope}/${pkg.name}`;
-            pkg.name = newName;
-            isScoped = true;
-            currentAccess = checkNpmAccess(newName);
-            writePackageJson(cwd, pkg);
-            console.log(colors.green(`✓ Renamed package to ${newName}`));
-            // Save scope to .userconfig if not already there
-            if (!userConfig.scope) {
-                const saveScope = await confirm(`Save scope "${normalizedScope}" to global config (${getUserConfigDir()}\\npm.json5)?`, true);
-                if (saveScope) {
-                    writeUserNpmConfig({ scope: normalizedScope });
-                    console.log(colors.green(`✓ Saved default scope to ${getUserConfigDir()}\\npm.json5`));
-                }
-            }
+            // Only reachable with noprefix: true (the unscoped guard above returned
+            // otherwise). noprefix says "publish unscoped", private says "restricted",
+            // and npm cannot do both. The rename prompt that used to live here is gone
+            // (2026-09-14, see the guard above).
+            console.log(colors.yellow(`${pkg.name} is unscoped (noprefix) and npm cannot restrict an unscoped package. Not publishing; use -npm public to publish it unscoped and PUBLIC.`));
+            return false;
         }
         if (currentAccess === 'public') {
             console.log(colors.yellow(`Package '${pkg.name}' is currently PUBLIC on npm. Converting to private...`));
@@ -7653,47 +7631,10 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 console.log(colors.dim(`  Use --npm public to make it public`));
             }
             else {
-                // Unscoped new package — prompt to add scope (same as explicit-private path)
-                const ucfg = readUserNpmConfig();
-                const auth2 = checkNpmAuth();
-                const defaultScope = ucfg.scope
-                    || (auth2.username ? `@${auth2.username}` : undefined);
-                const scopedExample = defaultScope ? `${defaultScope}/${pkg.name}` : `@scope/${pkg.name}`;
-                console.log(colors.yellow(`WARNING: Package '${pkg.name}' is unscoped and will be PUBLIC.`));
-                console.log(colors.yellow(`  Unscoped packages cannot be private on npm.`));
-                if (dryRun) {
-                    console.log(`  [dry-run] Would prompt to add scope (e.g., ${scopedExample})`);
-                }
-                else {
-                    const addScope = await confirm(`Add scope to make it private (e.g., ${scopedExample})?`, true);
-                    if (addScope) {
-                        const scope = await promptText('Scope:', defaultScope);
-                        if (scope) {
-                            const normalizedScope = scope.startsWith('@') ? scope : `@${scope}`;
-                            const newName = `${normalizedScope}/${pkg.name}`;
-                            pkg.name = newName;
-                            isScoped = true;
-                            currentAccess = checkNpmAccess(newName);
-                            writePackageJson(cwd, pkg);
-                            console.log(colors.green(`✓ Renamed package to ${newName}`));
-                            if (!ucfg.scope) {
-                                const saveScope = await confirm(`Save scope "${normalizedScope}" to global config (${getUserConfigDir()}\\npm.json5)?`, true);
-                                if (saveScope) {
-                                    writeUserNpmConfig({ scope: normalizedScope });
-                                    console.log(colors.green(`✓ Saved default scope to ${getUserConfigDir()}\\npm.json5`));
-                                }
-                            }
-                        }
-                        else {
-                            console.log(colors.yellow(`  No scope provided. Continuing as public.`));
-                            console.log(colors.yellow(`  Use --npm public to suppress this prompt.`));
-                        }
-                    }
-                    else {
-                        console.log(colors.yellow(`  Continuing as public.`));
-                        console.log(colors.yellow(`  Use --npm public to suppress this prompt.`));
-                    }
-                }
+                // Unscoped new package. Only reachable with noprefix: true (the unscoped
+                // guard above returned otherwise), so publishing it PUBLIC is the stated
+                // intent. The rename prompt that used to live here is gone (2026-09-14).
+                console.log(colors.yellow(`Package '${pkg.name}' is unscoped (noprefix) and will publish as PUBLIC — npm cannot restrict an unscoped package.`));
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.228",
+  "version": "1.0.229",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",